Cisco IOS Software Releases 12.3 T

Table Of Contents

Per Interface mroute State Limit

Contents

Prerequisites for Per Interface mroute State Limit

Information About Per Interface mroute State Limit

Per Interface mroute State Limit Feature Design

Benefits of Per Interface mroute State Limit

How to Configure Per Interface mroute State Limit

Enabling mroute State Limit on the Outgoing Interfaces

Enabling mroute State Limit on the Incoming Interface

Enabling mroute State Limit on the Incoming Interface Where the Sender Source is Connected to the Interface

Verifying the Per Interface mroute State Limit

Configuration Examples for Per Interface mroute State Limit

Per Interface mroute State Limit: Example

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Command Reference

clear ip multicast limit

debug ip mrouting limit

ip multicast limit

show ip multicast

Per Interface mroute State Limit

---

The mroute state is maintained by multicast routers for the incoming and outgoing interfaces for each source and group (S,G) pair. The state is used to determine which packets are to be discarded and which packets are to be forwarded, and each state entry in the routing table is referred to as an mroute. The Per Interface mroute State Limit feature limits the number of mroute states on an individual interface basis.

History for the Per Interface mroute State Limit Feature

Release	Modification
12.3(14)T	This feature was introduced.

Finding Support Information for Platforms and Cisco IOS Software Images

Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.

Contents

•Prerequisites for Per Interface mroute State Limit

•Information About Per Interface mroute State Limit

•How to Configure Per Interface mroute State Limit

•Configuration Examples for Per Interface mroute State Limit

•Additional References

•Command Reference

Prerequisites for Per Interface mroute State Limit

•Protocol Independent Multicast (PIM) must be configured on interfaces that are being limited.

Information About Per Interface mroute State Limit

Before you configure the Per Interface mroute State Limit feature, you should understand the following concepts:

•Per Interface mroute State Limit Feature Design

•Benefits of Per Interface mroute State Limit

Per Interface mroute State Limit Feature Design

The state being limited is specified by a standard or extended access list.

•A standard access list limits by group (G).

•An extended access list limits by source and group (S,G).

•Matching an mroute (*,G) is accomplished by using (O,G).

•Reverse Path Forwarding (RPF) plus out is assumed if the connected, rpf, or out keywords are not used.

The Per Interface mroute State Limit feature implements a method of limiting the amount of (*,G) and (S,G) mroute state by limiting the total number of times specific interfaces are allowed to appear respectively in the outgoing interface list (olist), as an incoming interface (rpf interface), or as an interface in which the multicast source (S) is connected.

Each time an mroute gets added or deleted, the first rpf, connected, or the in and out access list matches the mroute and has the interface as the incoming interface, the mroute is consulted. Source (S) must be on the incoming interface in order to match the connected access list.

Each time the interface gets added to or deleted from an mroute olist, the first out or in plus out access list that matches the mroute is consulted. The consulted access list is called the "limiter" or "accounter."

The accounter is incremented or decremented; however, if incrementing would exceed the configured maximum, adding is not allowed. Deleting is always allowed.

If the interface is a subinterface, the same algorithm applies to the corresponding main interface which accumulates its subinterface access accounting with its own limiters. Accounting is not aware of the main interface as the incoming interface and the main interface is not added to any outgoing access list.

If the group is Source Specific Multicast (SSM), accounting is not done for (*,G) because it is an internal invisible Cisco IOS state.

For optimization the following should be checked: If an IGMP or PIM join message on an interface would result in the creation of a state for which the interface already reached its out limit, then no state is created as it would serve no purpose without an olist.

Benefits of Per Interface mroute State Limit

•Per interface mroute state limiting can be used to prevent Denial of Service (DOS) attacks on a multicast router.

•Per interface mroute state limiting can be used to reduce memory and CPU usage.

How to Configure Per Interface mroute State Limit

This section contains the following procedures:

•Enabling mroute State Limit on the Outgoing Interfaces

•Enabling mroute State Limit on the Incoming Interface

•Enabling mroute State Limit on the Incoming Interface Where the Sender Source is Connected to the Interface

•Verifying the Per Interface mroute State Limit

Enabling mroute State Limit on the Outgoing Interfaces

Perform this task to enable the outgoing interface for any mroute.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type number

4. ip multicast limit out access-list max-entries

5. access-list acl-number permit any

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	interface type number Example: Router (config)# interface FastEthernet 1	Configures an interface type and enters interface configuration mode.
Step 4	ip multicast limit out access-list max-entries Example: Router (config-if)# ip multicast limit out 15 100	Specifies the interface limit for an outgoing interface in an mroute matching the access list.
Step 5	access-list acl-number permit any Example: Router (config-if)# access-list 15 permit any	Configures an access list.

Enabling mroute State Limit on the Incoming Interface

This task shows how to enable the incoming interface for any mroute.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type number

4. ip multicast limit rpf access-list max-entries

5. access-list acl-number permit any

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	interface type number Example: Router (config)# interface FastEthernet 1	Configures an interface type and enters interface configuration mode.
Step 4	ip multicast limit rpf access-list max-entries Example: Router (config-if)# ip multicast limit rpf 16 100	Specifies the interface limit for an incoming interface in an mroute matching the access list.
Step 5	access-list acl-number permit any Example: Router (config-if)# access-list 16 permit any	Configures the access list.

Enabling mroute State Limit on the Incoming Interface Where the Sender Source is Connected to the Interface

Perform this task to configure mroute limits for incoming interfaces where the source is connected to the interface.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type number

4. ip multicast limit connected access-list max-entries

5. access-list acl-number permit any

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	interface type number Example: Router (config)# interface FastEthernet 1	Configures an interface type and enters interface configuration mode.
Step 4	ip multicast limit connected access-list max-entries Example: Router (config-if)# ip multicast limit connected 17 100	Specifies the interface limit for an incoming interface in an mroute matching the access list.
Step 5	access-list acl-number permit any Example: Router (config-if)# access-list 17 permit any	Configures the access list.

Verifying the Per Interface mroute State Limit

To verify the configuration, use the show ip multicast limit command. Sample output is located in the "Configuration Examples for Per Interface mroute Limit" section on page 7.

SUMMARY STEPS

1. show ip multicast limit

2. debug ip mrouting limit

DETAILED STEPS

---

Step 1 show ip multicast limit

This command displays the counters that the interfaces currently have for each configured access list.

Router# show ip multicast limit 

Interface Ethernet1/0

 Multicast Access Limits

out acl out-list (1 < max 32) exceeded 0

rpf acl rpf-list (6 < max 32) exceeded 0

con acl conn-list (0 < max 32) exceeded 0

Step 2 debug ip mrouting limit

The debug ip mrouting command can be used to display a limit increment, a decrement, or a denial to add an mroute in which the maximum for a standard access list was reached.

Router# debug ip mrouting limit

MRL(0): incr-ed acl `rpf-list' to (13 < max 32), [n:0,p:0], (main) Ethernet1/0, 
(40.202.60.41, 225.30.200.60)

MRL(0): decr-ed acl `rpf-list' to (10 < max 32), [n:0,p:0], (main) Ethernet1/0, (*, 
225.40.202.60)

MRL(0): Add mroute (42.43.0.43, 225.30.200.60) denied for Ethernet0/2, acl std-list, (16 = 
max 16)

Configuration Examples for Per Interface mroute State Limit

This section provides the following configuration example:

•Per Interface mroute State Limit: Example

Per Interface mroute State Limit: Example

The following example shows how to configure FastEthernet interface 1 to appear a maximum of 100 times in any mroute:

interface FastEthernet 1

 ip multicast limit out 15 100

access-list 15 permit any

Additional References

The following sections provide references related to the Per Interface mroute State Limit feature.

Related Documents

Related Topic	Document Title
Multicast commands: complete command syntax, command mode, command history, defaults, usage guidelines, and examples	Cisco IOS IP Command Reference, Volume3 of 4: Multicast, Release 12.3T
Multicast configuration tasks	"Configuring IP Multicast Routing" chapter of Part 3 of the Cisco IOS IP Configuration Guide, Release 12.3

Standards

Standards	Title
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.	—

MIBs

MIBs	MIBs Link
No new or modified MIBs are supported by this feature.	To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: http://www.cisco.com/go/mibs

RFCs

RFCs	Title
No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.	—

Technical Assistance

Description	Link
Technical Assistance Center (TAC) home page, containing 30,000 pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content.	http://www.cisco.com/public/support/tac/home.shtml

Command Reference

This section documents new and modified commands only.

•clear ip multicast limit

•debug ip mrouting limit

•ip multicast limit

•show ip multicast

clear ip multicast limit

To clear IP multicast limit exceeded counters, use the clear ip multicast limit command in privileged EXEC mode.

clear ip multicast limit [interface type number]

Syntax Description

interface type number

(Optional) An interface that has been limited by the ip multicast limit command.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.3(14)T	This command was introduced.

Usage Guidelines

Use this command to clear limit exceeded counters for IP multicast limits.

The following example shows how to delete the limit exceeded counters for FastEthernet interface 1:

clear ip multicast limit interface FastEthernet 1

Related Commands

Command	Description
ip multicast limit	Configures an interface to be limited to a maximum number of entries in multicast state for all groups and channels matched by an access list.

debug ip mrouting limit

To debug mroute limiting and to display the reason for the limiting, use the debug ip mrouting limit command in privileged EXEC mode. To disable debugging output, use the no form of this command.

debug ip mrouting limit [group-name]

no debug ip mrouting limit

Syntax Description

group-name

(Optional) Name of a multicast group.

Privileged EXEC

Command History

Release	Modification
12.3(14)T	This command was introduced.

Usage Guidelines

This command may generate a substantial amount of output. Use the optional group-name argument to limit the output to a single multicast group.

Examples

The following example shows a limit increment, a decrement, and a denial to add an mroute in which the maximum for a standard access list was reached:

Router# debug ip mrouting limit

MRL(0): incr-ed acl `rpf-list' to (13 < max 32), [n:0,p:0], (main) Ethernet1/0, 
(40.202.60.41, 225.30.200.60)

MRL(0): decr-ed acl `rpf-list' to (10 < max 32), [n:0,p:0], (main) Ethernet1/0, (*, 
225.40.202.60)

MRL(0): Add mroute (42.43.0.43, 225.30.200.60) denied for Ethernet0/2, acl std-list, (16 = 
max 16)

Related Commands

Command	Description
debug ip pim	Displays all PIM announcements received.

ip multicast limit

To configure an interface to be limited to a maximum number of entries in the multicast state for all groups and channels permitted by an access list, use the ip multicast limit command in interface configuration mode. To remove the limit, use the no form of this command.

ip multicast limit [connected | rpf | out out-list] access-list max-entries

no ip multicast limit [connected | rpf | out out-list] access-list max-entries

Syntax Description

connected	(Optional) Specifies (S,G) multicast routes that use Reverse Path Forwarding (RPF) to the interface, where S is directly connected to the interface.
rpf	(Optional) Indicates multicast routes that use RPF to the interface.
out out-list	(Optional) Indicates multicast routes having the interface as an entry in their outgoing interface (OIF) list.
access-list	Number or name identifying an access list that controls the multicast group addresses and sender source addresses affected by the limit.
max-entries	Maximum number of entries permitted by an access list.

Defaults

Multicast limit is disabled.

Command Modes

Interface configuration

Command History

Release	Modification
12.3(14)T	This command was introduced.

Usage Guidelines

Use the ip multicast limit command to configure an interface to be limited to a maximum number of entries in the multicast state for all groups and channels permitted by the access list.

The following rules govern the ip multicast limit command:

•When rpf is specified, the command only applies to the multicast routes that use Reverse Path Forwarding (RPF) to the interface.

•When out is specified, the command only applies to the multicast routes that have the interface as an entry in their outgoing interface (OIF) list.

•When connected is specified, the command only applies to the single source address and destination multicast group address (S,G) multicast routes that use RPF to the interface and where S is directly connected.

•If none of the above keywords are specified, rpf plus out is assumed.

•If the ip multicast limit command is configured on a main interface that has subinterfaces, or on a virtual template interface, it establishes another limiter that counts against all subinterfaces or access interfaces associated with the main interface.

Examples

The following example shows how to set up a limit for directly connected sources on an interface:

interface FastEthernet 1

ip multicast limit connected 3 2

end

Related Commands

Command	Description
clear ip multicast limit	Defines a standard IP access list.
debug ip mrouting limit	Debugs mroute limiting and the reason for the limiting.
show ip multicast limit	Displays IP multicast limit information.

show ip multicast

To display IP multicast limit information, use the show ip multicast command in user EXEC or privileged EXEC mode.

show ip multicast [global | interface | limit | vrf] interface-type interface-number

Syntax Description

global	(Optional) Multicast global information.
interface	(Optional) Multicast interface information.
limit	(Optional) Multicast limit information.
vrf	(Optional) Select VPN Routing/Forwarding instance.
interface-type interface-number	Interface type and number.

Command Modes

User EXEC
Privileged EXEC

Command History

Release	Modification
12.3(14)T	The global and limit keywords were added.

Usage Guidelines

The multicast routing table is populated by creating (S,G) entries from (*,G) entries. The asterisk (*) refers to all source addresses, the "S" refers to a single source address, and the "G" is the destination multicast group address. In creating (S,G) entries, the software uses the best path to that destination group found in the unicast routing table (that is, through Reverse Path Forwarding [RPF]).

The output for the show ip multicast command will display the IP multicast information configured on each interface.

Examples

The following sample output shows the counters that the interfaces currently have for each configured access list.

Router# show ip multicast limit

Interface Ethernet1/0

 Multicast Access Limits

out acl out-list (1 < max 32) exceeded 0

rpf acl rpf-list (6 < max 32) exceeded 0

con acl conn-list (0 < max 32) exceeded o

The following sample output shows that there have been 36 attempts to increase the counter above the configured maximum.

Router# show ip multicast limit

Interface Ethernet0/2

 Multicast Access Limits

i+o acl std-list (15 < max 16) exceeded 36

Related Commands

Command	Description
ip multicast limit	Configures an interface to limit the multicast state for all groups and channels permitted by an access list to a maximum number of entries.

Copyright © 2005 Cisco Systems, Inc. All rights reserved.